# Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)

> Embee Research dissected a Latrodectus downloader delivered as a heavily obfuscated 845KB JScript file using junk-comment padding and self-referencing (comment-embedded) code to conceal a second-stage VBScript. The VBScript maps a network drive to the malicious domain sokingscrosshotel[.]com and uses WMI to spawn msiexec.exe, silently installing a remotely hosted MSI (upd.msi) before tearing down the drive mapping to reduce forensic footprint.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1486
- **ID:** TL-2026-1486
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA578 - G1038
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Latrodectus (aka BlackWidow, IceNova, Lotus, Unidentified 111, and tracked by MITRE as S1160) is a Windows malware loader first observed in November 2023 and assessed with high confidence to have been built by former IcedID developers based on shared code lineage, infrastructure overlap, and identical operator jumpboxes. It rose to prominence through 2024 as a functional successor to IcedID, deployed primarily by TA577 (initial distributor, November 2023) and TA578 (primary operator from mid-January 2024 onward, previously associated with IcedID and Bumblebee).

This sample, analyzed by Embee Research and uploaded to MalwareBazaar by researcher pr0xylife, demonstrates a distinctive three-stage JScript/VBScript delivery chain built specifically to defeat static analysis and automated sandboxing:

Stage 1 — a JScript file inflated from a functional ~37 lines to 1,890 total lines (845KB on disk) via thousands of `//`-prefixed junk comment lines generated from a wordlist. This bulk both evades size-based heuristics and overwhelms manual review.

Stage 2 — after junk-comment lines are filtered out, the remaining ~37 lines of legitimate JScript execute a self-referencing read: the script opens and reads its own file contents from disk, then uses regex pattern matching to extract only the lines prefixed with `////` (four forward slashes) — a sub-pattern of the Stage 1 junk-comment prefix, so the real payload hides in plain sight inside what looks like more filler.

Stage 3 — the extracted `////` lines assemble into a VBScript payload. This VBScript instantiates a `WScript.Network` COM object and issues the equivalent of `net use` to map a network drive against a WebDAV/SMB share hosted at the attacker domain sokingscrosshotel[.]com. It then invokes WMI (via `wmiprvse.exe`) to spawn `msiexec.exe`, which silently pulls and installs the remote MSI package (upd.msi) from the newly mapped share — a technique that lets the actual malicious binary traverse the network as a signed-looking installer transaction rather than a direct HTTP/S download, and keeps msiexec.exe (a trusted LOLBin) as the visible parent/executing process for defense products. After installation, the script calls `RemoveNetworkDrive` to unmap the share and reduce artifacts left on disk.

The resulting MSI installs the Latrodectus DLL loader, which performs extensive sandbox/anti-analysis checks before beaconing: process-count thresholds (75+ processes required on Windows 10, 50+ on earlier versions), MAC address allow-listing, and CPU architecture validation. It registers a mutex ("runnung" — a deliberately misspelled string) to prevent reinfection, then beacons to its C2 over HTTP POST with RC4-encrypted (hardcoded key "12345"), base64-encoded parameters, frequently fronted behind Cloudflare. Latrodectus functions purely as a loader/downloader: core capabilities are host/domain enumeration, arbitrary DLL/EXE execution by export name, self-update, and self-restart. It has been observed downloading follow-on payloads including QakBot, DarkGate, PikaBot, and IcedID's own "bp.dat" module, making it a common first-stage foothold ahead of ransomware and other high-impact intrusions. Distribution has historically included thread-hijacked phishing emails with malicious links, oversized JavaScript attachments retrieved via curl, ISO files containing LNK stagers, and fake contact-form copyright-infringement lures.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1036.005 Match Legitimate Resource Name or Location
- T1564.004 NTFS File Attributes
- T1070.004 File Deletion
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1518.001 Security Software Discovery
- T1087.002 Domain Account
- T1482 Domain Trust Discovery
- T1069.002 Domain Groups
- T1570 Lateral Tool Transfer
- T1021.005 VNC
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1573.001 Symmetric Cryptography
- T1104 Multi-Stage Channels
- T1102 Web Service
- T1105 Ingress Tool Transfer

## Sources

- [Latrodectus Script Deobfuscation](https://www.embeeresearch.io/latrodectus-script-deobfuscation/)
- [Latrodectus, Software S1160](https://attack.mitre.org/software/S1160/)
- [Latrodectus Malware Analysis: IcedID 2.0](https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice)
- [Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns](https://thehackernews.com/2024/05/latrodectus-malware-loader-emerges-as.html)
- [Analyzing Latrodectus: The New Face of Malware Loaders](https://www.levelblue.com/blogs/levelblue-blog/analyzing-latrodectus-the-new-face-of-malware-loaders)
- [2024-03-11 Latrodectus IOCs](https://github.com/executemalware/Malware-IOCs/blob/main/2024-03-11%20Latrodectus%20IOCs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1486